nixos/profiles/security.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   ...
   6 }:
   7 with lib;
   8 {
   9   options = {
  10     security.kernel.mitigations = mkOption {
  11       type = types.str;
  12       default = "auto,nosmt";
  13       example = "off";
  14       description = ''
  15         Control optional mitigations for CPU vulnerabilities.  This is a set of
  16         curated, arch-independent options, each of which is an aggregation of
  17         existing arch-specific options.
  18       '';
  19     };
  20   };
  21   config = {
  22     boot.kernelPackages = mkDefault pkgs.linuxPackages;
  23     #boot.kernelPackages = pkgs.linuxPackages_latest;
  24     #boot.kernelPackages = pkgs.linuxPackages_hardened;
  25     #boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
  26     #environment.memoryAllocator.provider = "libc";
  27     nix.settings.allowed-users = [ "@users" ];
  28     /*
  29       nix.settings.substituters = [
  30       "https://nix-community.cachix.org"
  31       ];
  32       nix.settings.trusted-public-keys = [
  33       "nix-community.cachix.org:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
  34       ];
  35     */
  36     nix.settings.trusted-users = [
  37       "root"
  38       "@wheel"
  39     ];
  40     networking.firewall.pingLimit = "--limit 60/minute --limit-burst 5";
  41     security.allowSimultaneousMultithreading = false;
  42     security.apparmor.enable = mkDefault true;
  43     security.forcePageTableIsolation = true;
  44     security.lockKernelModules = mkDefault true;
  45     security.protectKernelImage = true;
  46     security.virtualisation.flushL1DataCache = "always";
  47     # Only allow members of the wheel group to execute sudo by setting
  48     # the executable’s permissions accordingly.
  49     # This prevents users that are not members of wheel
  50     # from exploiting vulnerabilities in sudo such as CVE-2021-3156.
  51     security.sudo.execWheelOnly = true;
  52     boot.blacklistedKernelModules = [
  53       # Obscure network protocols
  54       "ax25"
  55       "netrom"
  56       "rose"
  57
  58       # Old or rare or insufficiently audited filesystems
  59       "adfs"
  60       "affs"
  61       "bfs"
  62       "befs"
  63       "cramfs"
  64       "efs"
  65       "erofs"
  66       "exofs"
  67       "freevxfs"
  68       "f2fs"
  69       "hfs"
  70       "hpfs"
  71       "jfs"
  72       "minix"
  73       "nilfs2"
  74       "ntfs"
  75       "omfs"
  76       "qnx4"
  77       "qnx6"
  78       "sysv"
  79       "ufs"
  80     ];
  81     # kernel-hardening-checker -c /proc/config.gz -l /proc/cmdline -s <(sudo sysctl -a) -m show_fail
  82     boot.kernel.sysctl = {
  83       # Mitigate kernel pointer leaks
  84       "kernel.kptr_restrict" = 2;
  85       # Restricts the kernel log to the CAP_SYSLOG capability
  86       "kernel.dmesg_restrict" = 1;
  87       # Prevent information leaks
  88       #kernel.printk = "3 3 3 3";
  89       # Restrict eBPF to the CAP_BPF capability
  90       # and enable JIT hardening techniques
  91       # such as constant blinding.
  92       "kernel.unprivileged_bpf_disabled" = 1;
  93       "net.core.bpf_jit_harden" = 2;
  94       # Restricts loading TTY line disciplines
  95       # to the CAP_SYS_MODULE capability to prevent
  96       # unprivileged attackers from loading vulnerable
  97       # line disciplines with the TIOCSETD ioctl
  98       "dev.tty.ldisc_autoload" = 0;
  99       # The userfaultfd() syscall is often abused to exploit
 100       # use-after-free flaws.
 101       # Due to this, this sysctl is used to restrict
 102       # this syscall to the CAP_SYS_PTRACE capability.
 103       "vm.unprivileged_userfaultfd" = 0;
 104       # kexec is a system call that is used
 105       # to boot another kernel during runtime.
 106       "kernel.kexec_load_disabled" = 1;
 107       # User namespaces are a feature in the kernel which aim to
 108       # improve sandboxing and make it easily accessible for
 109       # unprivileged users however, this feature exposes
 110       # significant kernel attack surface for privilege
 111       # escalation so this sysctl restricts the usage of user
 112       # namespaces to the CAP_SYS_ADMIN capability.
 113       "kernel.unprivileged_userns_clone" = 0;
 114       # Restricts all usage of performance events to the
 115       # CAP_PERFMON capability
 116       "kernel.perf_event_paranoid" = 3;
 117       # Helps protect against SYN flood attacks
 118       "net.ipv4.tcp_syncookies" = 1;
 119       # Protects against time-wait assassination
 120       # by dropping RST packets for sockets
 121       # in the time-wait state.
 122       "net.ipv4.tcp_rfc1337" = 1;
 123       # Disable ICMP redirect acceptance and sending to prevent
 124       # man-in-the-middle attacks and minimize information disclosure.
 125       "net.ipv4.conf.all.accept_redirects" = 0;
 126       "net.ipv4.conf.default.accept_redirects" = 0;
 127       "net.ipv4.conf.all.secure_redirects" = 0;
 128       "net.ipv4.conf.default.secure_redirects" = 0;
 129       "net.ipv6.conf.all.accept_redirects" = 0;
 130       "net.ipv6.conf.default.accept_redirects" = 0;
 131       "net.ipv4.conf.all.send_redirects" = 0;
 132       "net.ipv4.conf.default.send_redirects" = 0;
 133       # Disable source routing, a mechanism
 134       # that allows users to redirect network traffic.
 135       "net.ipv4.conf.all.accept_source_route" = 0;
 136       "net.ipv4.conf.default.accept_source_route" = 0;
 137       "net.ipv6.conf.all.accept_source_route" = 0;
 138       "net.ipv6.conf.default.accept_source_route" = 0;
 139       /*
 140         # Disable TCP SACK, which is commonly exploited
 141         # and unnecessary for many circumstances.
 142         # https://serverfault.com/questions/10955/when-to-turn-tcp-sack-off
 143         "net.ipv4.tcp_sack" = 0;
 144         "net.ipv4.tcp_dsack" = 0;
 145         "net.ipv4.tcp_fack" = 0;
 146       */
 147       # Generate a random IPv6 address
 148       "net.ipv6.conf.all.use_tempaddr" = mkForce 2;
 149       "net.ipv6.conf.default.use_tempaddr" = mkForce 2;
 150       # Restricts usage of ptrace to only processes
 151       # with the CAP_SYS_PTRACE capability
 152       "kernel.yama.ptrace_scope" = 2;
 153       # Do source validation by confirming reverse path
 154       "net.ipv4.conf.all.rp_filter" = 1;
 155       "net.ipv4.conf.default.rp_filter" = 1;
 156       # Any process which has changed privilege levels or is execute only will not be dumped.
 157       "fs.suid_dumpable" = 0;
 158       "fs.protected_fifos" = 2;
 159       "fs.protected_regular" = 2;
 160       # TIOCSTI is a dangerous legacy operation that can be disabled on most systems.
 161       "dev.tty.legacy_tiocsti" = 0;
 162       # User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable.
 163       #"user.max_user_namespaces" = mkDefault 0;
 164     };
 165     # DOC: https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
 166     boot.kernelParams = [
 167       "oops=panic"
 168       #"quiet"
 169       #"loglevel=0"
 170       # Disable merging of slabs with similar size. May be necessary if there is
 171       # some reason to distinguish allocs to different slabs, especially in
 172       # hardened environments where the risk of heap overflows and layout control
 173       # by attackers can usually be frustrated by disabling merging. This will
 174       # reduce most of the exposure of a heap attack to a single cache (risks via
 175       # metadata attacks are mostly unchanged). Debug options disable merging on
 176       # their own.
 177       "slab_nomerge"
 178       # See slub_debug
 179       # https://gitlab.tails.boum.org/tails/tails/-/issues/19613#note_215741
 180       "slub_debug=FZ"
 181       # Control whether the page allocator should randomize its free lists.
 182       "page_alloc.shuffle=1"
 183       # Kernel detects whether your CPU model is vulnerable to issues that PTI mitigates
 184       # Disabling this feature removes hardening, but improves performance of system calls and interrupts.
 185       "pti=auto"
 186       # Controls the behavior of vsyscalls
 187       # (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy code).
 188       # Most statically-linked binaries and older versions of glibc use these calls.
 189       # With none, vsyscalls don't work at all.
 190       # This makes them quite hard to use for exploits but might break your system.
 191       "vsyscall=none"
 192       # Filesystem is not registered and clients get a -EPERM as result
 193       # when trying to register files or directories within debugfs.
 194       "debugfs=off"
 195       # Disabled because the wireguard module is not signed
 196       "module.sig_enforce=0"
 197       # Disable kernel features that allow userland to modify the running kernel
 198       # or to extract confidential information from the kernel.
 199       "lockdown=confidentiality"
 200       # https://www.kernel.org/doc/Documentation/x86/x86_64/boot-options.rst
 201       "mce=bootlog"
 202       "mitigations=${config.security.kernel.mitigations}" # kspp   | self_protection
 203       #"spectre_v2=on" # defconfig | self_protection
 204       #"spectre_v2_user=on" # defconfig | self_protection
 205       #"spec_store_bypass_disable=on" # defconfig | self_protection
 206       #"l1tf=on" # defconfig | self_protection
 207       #"mds=on" # defconfig | self_protection
 208       #"tsx_async_abort=on" # defconfig | self_protection
 209       #"srbds=on" # defconfig | self_protection
 210       #"mmio_stale_data=on" # defconfig | self_protection
 211       #"retbleed=on" # defconfig | self_protection
 212       #"spec_rstack_overflow=on" # defconfig | self_protection
 213       # Disable AVX to mitigate systems without microcode mitigation. No effect if the microcode mitigation is present. Known to cause crashes in userspace with buggy AVX enumeration.
 214       #"gather_data_sampling=force" # defconfig | self_protection
 215       # https://www.phoronix.com/news/randomize_kstack_offset-perf
 216       "randomize_kstack_offset=1" # kspp   | self_protection
 217       # See https://unix.stackexchange.com/questions/592538/what-are-the-implication-of-using-iommu-force-in-the-boot-kernel-options
 218       "iommu=force" # clipos  | self_protection
 219       # DMA unmap operations invalidate IOMMU hardware TLBs synchronously.
 220       "iommu.strict=1" # kspp   | self_protection
 221       "kfence.sample_interval=100" # a13xp0p0v | self_protection
 222       "kfence.deferrable=1"
 223       # Unconditionally disables IA32 emulation
 224       "ia32_emulation=0" # a13xp0p0v |cut_attack_surface
 225       # A bit too much
 226       # https://patchwork.kernel.org/project/linux-security-module/patch/20190626121943.131390-2-glider@google.com/#22731857
 227       #"init_on_alloc=1" #    kspp   | self_protection
 228       #"init_on_free=1" #    kspp   | self_protection
 229     ];
 230     services.journald.extraConfig = ''
 231       Compress=true
 232       MaxRetentionSec=1month
 233       Storage=persistent
 234       SystemMaxUse=100M
 235     '';
 236     systemd.coredump = {
 237       enable = mkDefault false;
 238       extraConfig = ''
 239         Compress=true
 240         MaxUse=1024M
 241         Storage=external
 242       '';
 243     };
 244     services.openssh = {
 245       # Avoid TOFU MITM by providing well known public keys here.
 246       knownHosts = {
 247         "git.sr.ht".hostNames = [ "git.sr.ht" ];
 248         "git.sr.ht".publicKey =
 249           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
 250
 251         "github.com".hostNames = [ "github.com" ];
 252         "github.com".publicKey =
 253           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
 254
 255         "gitlab.com".hostNames = [ "gitlab.com" ];
 256         "gitlab.com".publicKey =
 257           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
 258       };
 259       openFirewall = mkDefault false;
 260       settings = {
 261         Ciphers = [
 262           # Not hardware accelerated, but fast enough and somehow more secure
 263           # (packet sizes are encrypted and less vulnerable to timing attacks).
 264           "chacha20-poly1305@openssh.com"
 265           # A bit more throughput.
 266           "aes128-gcm@openssh.com"
 267           "aes256-gcm@openssh.com"
 268         ];
 269         KbdInteractiveAuthentication = mkDefault false;
 270         # Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
 271         KexAlgorithms = [
 272           "curve25519-sha256"
 273           "curve25519-sha256@libssh.org"
 274           "diffie-hellman-group16-sha512"
 275           "diffie-hellman-group18-sha512"
 276           "sntrup761x25519-sha512@openssh.com"
 277         ];
 278         PasswordAuthentication = false;
 279         # Remove any remote gpg-agent's socket.
 280         StreamLocalBindUnlink = true;
 281         UseDns = mkDefault false;
 282         X11Forwarding = mkDefault false;
 283       };
 284     };
 285   };
 286   /*
 287     TODO: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
 288     =========================================================================================================================
 289                 option_name               | type  |desired_val | decision |      reason      | check_result
 290     =========================================================================================================================
 291     CONFIG_WERROR                           |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
 292     CONFIG_X86_KERNEL_IBT                   |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
 293     CONFIG_BUG_ON_DATA_CORRUPTION           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 294     CONFIG_SHUFFLE_PAGE_ALLOCATOR           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 295     CONFIG_DEBUG_VIRTUAL                    |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 296     CONFIG_DEBUG_SG                         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 297     CONFIG_INIT_ON_ALLOC_DEFAULT_ON         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 298     CONFIG_STATIC_USERMODEHELPER            |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 299     CONFIG_SECURITY_LOCKDOWN_LSM            |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 300     CONFIG_SECURITY_LOCKDOWN_LSM_EARLY      |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 301     CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 302     CONFIG_DEBUG_CREDENTIALS                |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 303     CONFIG_DEBUG_NOTIFIERS                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 304     CONFIG_KFENCE                           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 305     CONFIG_KFENCE_SAMPLE_INTERVAL           |kconfig| is not off |a13xp0p0v | self_protection  | FAIL: CONFIG_KFENCE is not "y"
 306     CONFIG_RANDSTRUCT_FULL                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 307     CONFIG_RANDSTRUCT_PERFORMANCE           |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_RANDSTRUCT_FULL is not "y"
 308     CONFIG_GCC_PLUGIN_LATENT_ENTROPY        |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 309     CONFIG_MODULE_SIG                       |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 310     CONFIG_MODULE_SIG_ALL                   |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 311     CONFIG_MODULE_SIG_SHA512                |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 312     CONFIG_MODULE_SIG_FORCE                 |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 313     CONFIG_INIT_ON_FREE_DEFAULT_ON          |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 314     CONFIG_EFI_DISABLE_PCI_DMA              |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 315     CONFIG_RESET_ATTACK_MITIGATION          |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 316     CONFIG_UBSAN_BOUNDS                     |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 317     CONFIG_UBSAN_LOCAL_BOUNDS               |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 318     CONFIG_UBSAN_TRAP                       |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_BOUNDS is not "y"
 319     CONFIG_UBSAN_SANITIZE_ALL               |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_BOUNDS is not "y"
 320     CONFIG_GCC_PLUGIN_STACKLEAK             |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 321     CONFIG_STACKLEAK_METRICS                |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y"
 322     CONFIG_STACKLEAK_RUNTIME_DISABLE        |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y"
 323     CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 324     CONFIG_CFI_CLANG                        |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y"
 325     CONFIG_CFI_PERMISSIVE                   |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y"
 326     CONFIG_DEFAULT_MMAP_MIN_ADDR            |kconfig|   65536    |   kspp   | self_protection  | FAIL: "4096"
 327     CONFIG_IOMMU_DEFAULT_DMA_STRICT         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 328     CONFIG_INTEL_IOMMU_DEFAULT_ON           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 329     CONFIG_SLS                              |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 330     CONFIG_INTEL_IOMMU_SVM                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 331     CONFIG_AMD_IOMMU_V2                     |kconfig|     y      |   kspp   | self_protection  | FAIL: "m"
 332     CONFIG_SLAB_MERGE_DEFAULT               |kconfig| is not set |  clipos  | self_protection  | FAIL: "y"
 333     CONFIG_LIST_HARDENED                    |kconfig|     y      |a13xp0p0v | self_protection  | FAIL: is not found
 334     CONFIG_RANDOM_KMALLOC_CACHES            |kconfig|     y      |a13xp0p0v | self_protection  | FAIL: is not found
 335     CONFIG_SECURITY_SELINUX_DISABLE         |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 336     CONFIG_SECURITY_SELINUX_BOOTPARAM       |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 337     CONFIG_SECURITY_SELINUX_DEVELOP         |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 338     CONFIG_SECURITY_WRITABLE_HOOKS          |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 339     CONFIG_SECURITY_DMESG_RESTRICT          |kconfig|     y      |   kspp   |cut_attack_surface| FAIL: "is not set"
 340     CONFIG_ACPI_CUSTOM_METHOD               |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 341     CONFIG_BINFMT_MISC                      |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 342     CONFIG_INET_DIAG                        |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 343     CONFIG_KEXEC                            |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 344     CONFIG_PROC_KCORE                       |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 345     CONFIG_HIBERNATION                      |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 346     CONFIG_COMPAT                           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 347     CONFIG_IA32_EMULATION                   |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 348     CONFIG_MODIFY_LDT_SYSCALL               |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 349     CONFIG_X86_MSR                          |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 350     CONFIG_MODULES                          |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 351     CONFIG_DEVMEM                           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 352     CONFIG_LDISC_AUTOLOAD                   |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 353     CONFIG_X86_VSYSCALL_EMULATION           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 354     CONFIG_KPROBE_EVENTS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 355     CONFIG_UPROBE_EVENTS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 356     CONFIG_GENERIC_TRACER                   |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 357     CONFIG_FUNCTION_TRACER                  |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 358     CONFIG_STACK_TRACER                     |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 359     CONFIG_BLK_DEV_IO_TRACE                 |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 360     CONFIG_PROC_PAGE_MONITOR                |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 361     CONFIG_CHECKPOINT_RESTORE               |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 362     CONFIG_USERFAULTFD                      |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 363     CONFIG_DEVPORT                          |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 364     CONFIG_DEBUG_FS                         |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 365     CONFIG_PUNIT_ATOM_DEBUG                 |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 366     CONFIG_ACPI_CONFIGFS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 367     CONFIG_MTD_SLRAM                        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 368     CONFIG_MTD_PHRAM                        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 369     CONFIG_IO_URING                         |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 370     CONFIG_KCMP                             |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 371     CONFIG_RSEQ                             |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 372     CONFIG_PROVIDE_OHCI1394_DMA_INIT        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 373     CONFIG_SUNRPC_DEBUG                     |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 374     CONFIG_FB                               |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
 375     CONFIG_VT                               |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
 376     CONFIG_BLK_DEV_FD                       |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "m"
 377     CONFIG_STAGING                          |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 378     CONFIG_KSM                              |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 379     CONFIG_KALLSYMS                         |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 380     CONFIG_MAGIC_SYSRQ                      |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 381     CONFIG_KEXEC_FILE                       |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 382     CONFIG_USER_NS                          |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 383     CONFIG_X86_CPUID                        |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "m"
 384     CONFIG_X86_IOPL_IOPERM                  |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 385     CONFIG_ACPI_TABLE_UPGRADE               |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 386     CONFIG_EFI_CUSTOM_SSDT_OVERLAYS         |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 387     CONFIG_AIO                              |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 388     CONFIG_KPROBES                          |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
 389     CONFIG_BPF_SYSCALL                      |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
 390     CONFIG_IP_DCCP                          |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 391     CONFIG_IP_SCTP                          |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 392     CONFIG_FTRACE                           |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
 393     CONFIG_INPUT_EVBUG                      |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 394     CONFIG_XFS_SUPPORT_V4                   |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
 395     CONFIG_TRIM_UNUSED_KSYMS                |kconfig|     y      |a13xp0p0v |cut_attack_surface| FAIL: "is not set"
 396     CONFIG_COREDUMP                         |kconfig| is not set |  clipos  | harden_userspace | FAIL: "y"
 397     CONFIG_ARCH_MMAP_RND_BITS               |kconfig|     32     |a13xp0p0v | harden_userspace | FAIL: "28"
 398     CONFIG_X86_USER_SHADOW_STACK            |kconfig|     y      |a13xp0p0v | harden_userspace | FAIL: is not found
 399   */
 400 }